Localization Token Missing for Session Timeout Audit Message
As per the original post.
If we look into a .zip export of the audit logs I can see two variables:
{
"message": "User session has expired.",
"user": "RdmcInitUser"
}
I therefore created token 'com.thingworx.things.security.SecurityMonitorThing.SessionExpired.Audit' with value '__message__ For user __user__'.
Not sure if the missing token was fixed in a later TWX release (I am also on 9.3.4 where it is missing).

